Attachment 03 - Task PWSs and SOWs.pdf

Information Technology Support Services (ITSS)

Task Performance Work Statement

(TSOW 1)

Cybersecurity Vulnerability Assessments Section Scanning

Enterprise Services Center 6500 South MacArthur Boulevard

Oklahoma City, OK 73125

22 November 2022

Table of Contents

1.0 Introduction and Overview

2.0 Background

3.0 Description of Work

4.0 Definitions/Acronyms

5.0 Performance Outcome(s)/Deliverable(s)

6.0 Reference Documents

7.0 TPWS Support Requirements

8.0 Place of Performance

9.0 Work Schedule (For all Cybersecurity Services Branch groups) ....................... Error! Bookmark not defined.

10.0 Training

11.0 Travel

12.0 Privacy and Security Requirements

13.0 Government Furnished Property

14.0 Government Surveillance - Inspection and Acceptance Criteria

15.0 Technical Exhibits:

Task Performance Work Statement (TPWS) Cybersecurity Vulnerability Assessments Section Scanning

Task Reference: TPWS 1 – Cybersecurity Vulnerability Assessments Section Scanning (previous contract Task 21) Type: Firm-Fixed Price Work Originator: Cybersecurity Vulnerability Assessments Section (AMK-233) Period of Performance: April 1, 2024 – March 30, 2029

Introduction and Overview The Enterprise Services Center’s (ESC) Cybersecurity Services Branch is a Department of Homeland Security (DHS) Cybersecurity & Infrastructure Security Agency (CISA) vetted Federal Shared Services Provider (FSSP) under the Cyber Quality Services Management Organization (QSMO) program that delivers outsourcing solutions of Cybersecurity Services to a wide variety of clients across various agencies in the U.S. Federal Government.

The Cybersecurity Vulnerability Assessments Section provides vulnerability scanning for operating systems, databases, and web applications along with patch management.

Background

Since ESC’s January 2009 designation by the Office of Management and Budget (OMB) as a Shared Services Center for Information Security Services, requests for service has grown dramatically. Cybersecurity Services Branch security compliance reviews assist Federal agencies in meeting their Federal Information Security Management Act (FISMA) obligations.

Cybersecurity Vulnerability Assessments Section:

The Cybersecurity Vulnerability Assessments Section is divided into specialized teams to support internal and external customers. Each team possesses a different skillset for vulnerability scanning of operating systems, databases and web applications.

The task must provide Compliance and Patch Management Reporting for the Cybersecurity Vulnerability Assessments Section. Additional services may include conducting briefings and presentations, and/or acting as a technical advisor at high-level government meetings.

Description of Work Cybersecurity Vulnerability Assessments Section

Information System Compliance Reports The primary goal of reporting and compliance is to provide information to decision makers to ensure each agency safeguards information systems and networks with appropriate security defenses. The submission of deliverables allows the Authorizing Official (AO) to evaluate the risks of the information system. Each scan requires development of a result report to present findings that are used to assess the health and security posture of the system and to assist in reducing cybersecurity risks.

The contractor must develop and produce system compliance reports for each type of scan that is performed on a system. System compliance reports must be created within two business days from the day the scans have been completed and all scan files have been posted with the contractors being notified of scans’ completion. Contractor may produce up to six compliance reports for each system.

The following must be included in each of the system compliance reports:

a. A Compliance Chart - Compliance tracking involves data generated by vulnerability scans over time. Compliance charts are generated to comply with federal regulations, prioritize patching efforts and track the age of vulnerabilities identified by the different monthly system scans. The 7, 30, 60, and 90 day time limits to mitigate weaknesses are established by the U.S. Department of Transportation (DoT) Departmental Cybersecurity Compendium and FedRamp requirements.

b. Details of identified finding – To assist in the prioritizing of patching or selecting a mitigation path; the details from the particular system scan can provide information about the findings. The detail should include the date of when the findings were first discovered and how many days old the findings are.

The contractor will maintain the Microsoft SQL Server queries to ensure that the data collected for the system compliance reports is valid and accurate. In addition, the contractor must maintain any .NET custom program developed to facilitate the creation of the system compliance reports. The contractor may only be allowed to perform eight (8) modifications a month to the custom program and disease. All modifications must be stored in the code repository and on the local file storage.

When an error is discovered in the standard system reports; the contractor must remediate the error within 40 business hours of receiving the error notification.

Standard System Reports Standard System Reports are produced to establish compliance with federal security regulations, guidelines, laws and agency security requirements. Scan reports are created when the scans have completed or on an as requested basis as a part of the continuous monitoring program and annual security control assessments on the information systems. Reports are broken down by operating systems, databases and web applications. Standard system reports are created for both internal systems and for external system engagements. Standard system reports are include in Vulnerability Assessment packages along with a Scanning Executive Summary.

Internal Standard System Reports Includes:

• Vulnerability Summary Reports per Operating Systems (Linux, Windows, Solaris)

• Vulnerability Summary Reports for Databases

• Vulnerability Summary Reports for each Web Application

External Standard System Reports Include:

• Vulnerability Details and Summary Reports per Operating Systems (Linux, Windows, Solaris)

• Vulnerability Details and Summary Reports for each Database

• Vulnerability Details and Summary Reports for each Web Application

All scan findings are documented and each unique vulnerability is tracked with the Microsoft SQL Server. Reports will rank detected vulnerabilities with a score of critical, high, medium, and low (as supported by the scanning tools) to support prioritization of remediation efforts.

The contractor must produce the standard system reports by developing and maintaining Microsoft SQL Server queries and .NET based custom programs as scanning teams request to summarize verbose findings from scanning tools. When an error is discovered in the standard system reports;

the contractor must remediate the error within 40 business hours of receiving the error notification.

Contractors must produces reports that require vulnerability analysis comments in an editable format such as MS Word document to allow the scanning team engagement members to supply the comments. All final reports are generated in PDF format and sent to the customers by the Government. Raw Reports are available in the following formats: PDF, HTML, CSV, and XML.

Deliverables are provided to the Data Owner or to the appointed recipient who works with the System Owners (SO) to remediate of weaknesses within the established time constraints by the method the data owner has requested.

FedRamp Scanning and Assessment Reports FedRamp provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by the US government. As an accredited FedRamp Third Party Assessment Organizations (3PAOs), we perform the initial and periodic assessments of cloud systems to ensure Cloud Service Provider’s (CSPs) meet FedRamp security requirements. As part of the 3PAO assessment team, we perform the vulnerability scanning services. FedRamp assessments require specific document to be include in the FedRamp assessment package at the time of completion. These templates are the Security Assessment Plan (SAP) and the Security Assessment Report (SAR) which completed jointly between the assessment team and the scanning team. The scanning team in addition to these also provides vulnerability scanning reports (which includes all the reports in the External Standard System Reports).

The contractor must assist in the creation of the Scanning reports. The contractor must validate all data entered into the report prior to providing the reports back to the scanning team selected for the FedRamp assessment. The scanning team will complete the reports with technical comments and other required information unknown to the contractor.

Ad-Hoc Reports, Customized Reports and Presentations Customers may ask for customized reports to further analyze their security position and interpret the data from the raw reports. Ad-Hoc/Custom scanning reports can be created based off of the type. (E.g. Operating Systems, Web Applications, Databases) Compliance or Standard Reports to provide a better comprehensive of the scan data and may vary in complexity depending on customization requested. Additional Graphs, charts, and diagrams to present the scan data and show evidence of patching and improvements are some examples of requests that come from the customer.

The contractor must create customized reports and presentations for customers that request these presentations on a monthly basis. The reports and presentations identify unique vulnerabilities. It is a 90 day comparison and is used to determine progress, historical elements, and show how the controls were managed over time.

The contractor must create customized presentations to support customers and government management. These presentation will include visual representation of overdue vulnerabilities and system’s vulnerability compliance status with the DOT compendium requirements. These presentations may include but are not limited to including: a list of vulnerabilities that have exceeded the mitigation requires from the DOT compendium, a patching metrics, and/or status of scans completed for each system.

In addition, customers may request a one-time report to collect information on a specific vulnerability or issue. These report are normally based off an agency wide data-call to report a specific vulnerability and how many of the vulnerability in question to DHS for high risk vulnerability.

The contractor must develop customized queries to collect and valid system data from regular system scans. The contractor must build a report from the collect data to be sent back to the customer making the request.

Education and Experience Requirements Contract support should have proficiency in the use of Microsoft Office products and e-mail processing. Contract support should possess a Bachelor’s Degree in an information technology related field or experience in information technology or information security field. Contract support should have basic knowledge with Microsoft SQL Server development and development work with .NET languages like Visual Basics and C#. Contract support should have the appropriate interpersonal skills and English (oral/written/typing) communication skills necessary to interact with Federal employees within the FAA and other Federal agencies.

Definitions/Acronyms

AMK-230 – Cybersecurity Services Branch AMK-232 – Cybersecurity Assessment Section AMK-233 - Cybersecurity Vulnerability Assessments Section AMK-234 - Cybersecurity Assessment Services Support Section CMA - Continuous Monitoring Assessments CMIS – Contract Management Information System COTS - Commercial off the shelf CPARS - Contractor Performance Assessment Reporting System CSMC - Cyber Security Management Center DOT - Department of Transportation ESC - Enterprise Services Center ES3 - External IS3 Website FAA - Federal Aviation Administration FIPS - Federal Information Processing Standards FISMA - Federal Information Security Management Act (2002) IS3 –Information System Security Services Website (Intranet) ISO – International Organization for Standardization ISSM - Information System Security Manager ISSO - Information System Security Officer IT - Information Technology MMAC - Mike Monroney Aeronautical Center) NIST - National Institute of Standards and Technology PBC - Provided By Client (PBC) tracker repository PL – Project Lead OIT - Office of Information Technology SA - System Administrator SA - Security Authorizations and Recertification’s SBCC - Security Baseline Configuration Checklists SO - System Owner SP - Special Publications (NIST) Information System - define by NIST as a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [Note: Information systems also include specialized systems such as industrial/process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems.] Custom Program Modifications – are changes that add additional user interface functionality or a change to SQL query’s to where original output data is including different/excluding data or creating new SQL queries for new reports.

Administrative Changes – are changes that does not affect data being reported or modifying the users interface.

Examples of administrative changes are like changing a database name, migrating scan data from one database to another database, or updating a query to pull correct data.

Performance Outcome(s)/Deliverable(s)

Cyber Security Vulnerability Assessments Section Outcomes/Tasks:

Outcome No. 1: Provide Compliance and Patch Reporting Services

Information system scanning reports involves developing monthly scanning reports to establish and track the age of scanning findings identified during monthly system scans and provide crisp and clean views of the scanning findings that can be easily understood by the information systems’ technical staff. System Owners are required by federal guidelines, established by the U.S. Department of Transportation Departmental Cybersecurity Compendium and FedRamp requirements, to patch and remediate identified vulnerabilities within a specified time frame based on the ranking category of critical, high, medium, and low. Any item not patched and remediated within the specified time frames is considered past due and will be identified in a system compliance report. Plan of Action and Milestones (POA&Ms) will be created and tracked for overdue vulnerabilities until the requirements are met and the POA&M is closed. Activities seek to improve the federal government’s security posture and promote a healthy, secure, and resilient IT infrastructure by proactively identifying and reporting on vulnerabilities and configurations issues present on federal hosts before those vulnerabilities can be exploited.

Task 1: Information System Compliance Reports Scan findings from operating system, database, web application, and configuration baselines are tracked on a monthly or bi-weekly or weekly basis using the current reporting tools. Scan data for each tool is imported and maintained as needed. System compliance reports are generated monthly from the in-house solutions. After scan findings are imported, using the in-house reporting tools, the system compliance report created. At established or ad hoc times the system compliance report is generated and provided to ISSO’s, ISSM, SO’s, Assessors, and Management. Reports are generated to show findings that are past due. POA&Ms are created in the designated repository system on all past due findings. As changes to the status occur, the POA&M is updated and logged. When the requirements have been met for closure, the POA&M is closed in the system repository.

a. Deliverable(s): Contractor must produce system compliance reports (to include, but not exclusive of, past due items and scan data monitoring) for each scan type.

Task 2: Internal System Standard Reports Scan data from operating system, database, and web application are imported on a monthly or bi-weekly or weekly basis using the current reporting tools. Scan data for each tool is imported and maintained as needed.

After the scan data is imported, using the in-house reporting tools, the summary reports of the standard system report grouping are created. Standard system reports are generated at least monthly from the in-house solutions. Standard system reports may include reports will be created per established requirements in the system agreement.

a. Deliverable(s):

1. Summary Reports per Operating System Grouping (Linux, Windows, Solaris)

2. Summary Report for System Databases

3. Summary Report for each Web Application

Task 2: External System Standard Reports and FedRamp Reports

Scan data from an operating system, database, and web application are imported during the established engagement with the external information system/FedRamp system using the current reporting tools. Scan data for each tool is imported and maintained as needed. After the scan data is imported, using the in-house reporting tools, the summary and detail reports of the standard system report grouping are created. Standard system reports will be created per established requirements in the system agreement. Standard system reports will be delivered back to the scanning team that provided the raw scanning data for them to review and completed as necessary.

b. Deliverable(s):

4. Scan reports per Operating System Grouping (Linux, Windows, Solaris)

5. Scan reports for each Database

6. Scan reports for each Web Application

Tiers: Cyber Security Vulnerability Assessments Section Tiered Services are monthly estimates that represent the number of systems and reports that will have monthly reports generated for.

Tier 1: Zero Systems for Compliance Reports with Zero Standard System Reports, FedRamp Reports, and up to 0 Ad-Hoc Reports per Month Tier 2: Up to 20 Systems for Compliance Reports with a 250 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 3: Up to 40 Systems for Compliance Reports with a 490 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Tier 4: Up to 60 Systems for Compliance Reports with a 610 Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Add-on (Small): 12 Additional Systems for Compliance Reports with a 120 Additional Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month Add-on (Large): 36 Additional Systems for Compliance Reports with a 360 Additional Standard System Reports, FedRamp Reports, and Ad-Hoc Reports per Month

Reference Documents Document No. Description Distribution

Internal Job Guides Job Guides outline scan functions and configuration settings used to produce a standardized product designed to meet the customer satisfaction, ISO standards and compliance with agency regulations.

Available at time of award

U.S. Department of Transportation Departmental Cybersecurity Compendium

Available at time of award

NIST 800-137 Information Security Continuous Monitoring for Federal Information Systems and Organizations

Available online http://csrc.nist.gov/publications

NIST SP 800-34 Contingency Planning Guide for Federal Information Systems

Federal Information Security Management Act (FISMA) of 2002 (or updated version)

FISMA assigns specific responsibilities to Federal Agencies, the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) in order to strengthen information security systems.

Available online

Federal Information Security Modernization Act of 2014 (or updated version)

Available online

OMB Memorandum M-06-16 Protection of Sensitive Agency Information

Available online

Federal Information Processing Standards (FIPS) Publication 199

Standards for Security Categorization of Federal Information and Information Systems

Document No. Description Distribution

Federal Information Processing Standards (FIPS) Publication 200

Minimum Security Requirements for Federal Information and Information Systems

Available online

NIST SP 800-53 (current version) Security and Privacy Controls for Federal Information Systems and Organizations

Available online http://csrc.nist.gov/publications

NIST SP 800-53A (current version)

Assessing Security and Privacy Controls in Federal Information Systems and Organizations - Building Effective Assessment Plans

Available online http://csrc.nist.gov/publications

NIST SP 800-37 (current version) Guide for Applying the Risk Management Framework to Federal Information Systems

Available online http://csrc.nist.gov/publications

AMKWI-230-50001 Assessment Process (current version)

ISO Work Instruction – Assessment Process

Available when needed

Office of Management and Budget (OMB) Circular A-130, Management of Federal Information Resources

Available online

Contractor Performance Assessment Reporting System

CPARS)

CPARS hosts a suite of web-enabled applications that are used to document contractor and grantee performance information that is required by Federal Regulations.

Available online https://www.cpars.gov/

FedRamp Assessment Documents FedRamp standardizes the Federal Government’s requirements and approach to security assessment, authorization, and monitoring of cloud products and services.

Available online https://www.fedramp.gov/templates/

TPWS Support Requirements Contractor must provide on-site (task lead or contract resource) for the following functions to include:

a. Coordinating with the COR on task issues/concerns;

b. Performing work on the task;

c. Providing OJT to new contract employees;

d. Managing and assigning work to contract employees;

http://csrc.nist.gov/publications http://csrc.nist.gov/publications http://csrc.nist.gov/publications https://www.cpars.gov/ https://www.fedramp.gov/templates/

e. Responsible for quality assurance and monitoring

f. Resolve discipline actions with the contractor’s employees;

g. Address disputes/customer complaints with COR;

h. Ensuring contract employee’s time is properly entered on the government contract labor and time (CMIS) intranet web site.

Place of Performance Contract services must be performed at the FAA’s Mike Monroney Aeronautical Center in Oklahoma City, OK.

Hours of Work Services are to be performed on-site, or via approved telework, Monday through Friday (excluding federal holidays and facility closures) between the operating hours of 0600 to 1800 CT. Contract personnel shall work forty (40) hours each week.

Telework Approval for teleworking Contractors under this Task will be considered on a case-by-case basis by the government. Said approval may be cancelled at the discretion of the government on a case-by-basis. Past approval is not an indication of future approval.

Approved teleworking Contractors would be expected to have reliable high-speed Internet access along with all other appropriate logistical and support features for an appropriate office setting. There will be no direct cost to the government for telework location support office items.

Approved teleworking Contractors may only work from the CONUS, Alaska or Hawaii. Use of third party Virtual Private Networking (VPN) to mask a teleworking Contractors actual remote work site is prohibited.

Downtime on a teleworking Contractor’s end (e.g., power outage, Internet outage or government-issued laptop) is not billable to the government. Physical proximity to Oklahoma City minimizes downtime as teleworking Contractors encountering issues may immediately go onsite to continue work.

Training Reference PWS Section 2.12.

Travel No travel is authorized for this task.

Privacy and Security Requirements Contractors must meet personnel security/suitability sensitivity levels commensurate with their position sensitivity level and are subject to personnel investigation requirements (e.g., FAA Order 1600.1E & 1600.73).

Contractors will be required to sign a Rules of Behavior statement pertaining to system administrator role.

Content of all data the contractor works with and results are assumed to be privacy data and will be held confidential

Government Furnished Property Reference PWS Section 6.3

Government Surveillance - Inspection and Acceptance Criteria The Government will evaluate the contractor’s performance on this task in accordance with the Technical Exhibits provided in Section 15.0 below.

The Quality Assurance Surveillance Plan (QASP) must focus on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how to apply performance standards, the frequency of surveillance, and the minimum acceptable defect rate(s).

Technical Exhibits:

Technical Exhibit 1 - Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Task Deliverable(s) Applicable Standard(s) Acceptable Quality Level(s)

TPWS Paragraph 5.1 The contractor must perform compliance tracking and reporting of scan findings from monthly vulnerability, database, web application, and configuration baselines.

The AMKJG-230-50455 - Compendium Compliance Report Job Guide

Provide at time of award.

98% compliance. Reports are delivered on a monthly basis with updated and accurate data.

Task Performance Work Statement

(TPWS 2)

Enterprise Data Center (EDC)

June 5, 2022

Introduction and Overview

Background

Description of Work

Definitions/Acronyms

Performance Outcome(s)/Deliverable(s)

Reference Documents (if applicable)

TPWS Support Requirements

Place of Performance

Work Schedule

Training

Travel

Privacy and Security Requirements

Government Furnished Property

Government Surveillance - Inspection and Acceptance Criteria

Technical Exhibits:

Technical Exhibit 1 - Performance Requirements Summary ... 20

Enterprise Data Center (ESC EDC)

Task Reference No.: TPWS 2 – EDC Type: Firm-Fixed Price Work Originator: Enterprise Data Center (AMK-220) Period of Performance: April 1, 2024 – March 30, 2029

The ESC Data Center is an ISO 20000-certified, mission-critical enterprise data center operating 24/7/365 providing data processing support, including system design, implementation and support for the Department of Transportation and many other government agencies. The infrastructure consists of about 900 physical and virtual servers, over 175 Oracle databases, more than 30 SQL Server databases, and offers in excess of 1,700 terabytes of physical data storage. The facility has redundant operations in cooling, emergency power, and uninterrupted power and is rated as a Tier 3 data center. ESC EDC provides technical, developmental and administrative support for SQL databases, Oracle databases, Oracle Financial systems and web applications from cradle to grave.

Background The ESC EDC supplies all hardware and software development, test, production, operations, maintenance and disaster recovery services for ESC.

Description of Work The contractor must provide the technical services described in this section. Nominal support hours required to perform these services are described where applicable. The services must be functional, accessible and usable 24 hours a day, 7 days a week.

The contractor must provide computer services including both Data Center Operations and Software Engineering. These include such services as the operation, maintenance, and sustaining engineering of computing systems, distributed servers, and peripherals, as well as the development and maintenance of computer and web applications.

The nominal support requirement for this service is 0600 through 1800, Monday through Friday, and performing remote monitoring with on-call support at all other times. Additional support may be required during major events based on scheduled customer requirements and may result in 2nd shift, 3rd shift, weekend, or holiday work.

3.1 Application Administration

The contractor must provide the technical services described in this section. Nominal support hours required to perform these services are described where applicable. The services must be functional, accessible and usable 24 hours a day, 7 days a week.

a. Perform application administration including monitoring, logging, and reporting applications performance and capacity utilization to identify potential problems and recommend systems enhancements. Prepare and verify job execution programs.

b. Provide Application Administration (AA) services for the FAA applications.

c. The nominal support requirement for this service is 0600 – 1800 local time, Monday through Friday, and performing remote monitoring with on-call support at all other times. Additional support may be required during major events based on scheduled customer requirements and may result in 2nd shift, 3rd shift, weekend, or Federal holiday work.

These include such services as the operation, maintenance, and sustaining production application support, as well as the development and maintenance of computer and web applications.

Support must include, but is not limited to the following:

a. User Access Request (UAR) support, including user-id creation/deletion/activation/deactivation/locks/unlocks.

b. Monitor incoming ticket queue and work or route tickets as they arrive.

c. Centralized processing job troubleshooting, on an ad-hoc basis, resulting from processing errors, which must be resolved prior to next processing cycle.

d. Weekly migration support, which occurs each weekend, or on an ad-hoc basis.

e. End-of-month support, 12 times per year.

f. Year-end support, twice a year. (Year end 1 and 2)

g. Release support, four times a year.

h. Daily Checklist and monitoring user configured processing jobs, on an ad-hoc basis, resulting from processing errors, which must be resolved prior to next processing cycle.

i. Daily “Concurrent Manager” exports support, for middle tier configurations in the Oracle E-Business Suite.

j. Oracle E-Business Suite workflow support, on an ad-hoc basis, resulting from processing errors, which must be resolved prior to next processing cycle.

k. Outage notification processes, as needed during core hours or outside of shift.

l. Oracle E-Business Suite application system administration tasks, including but not limited to setup and/or validation of profile options, concurrent managers, security, user account, password resets, workflow, request groups, menus, responsibilities and instance validation.

m. Centralized data warehouse job troubleshooting, on an ad-hoc basis, resulting from processing errors, which must be resolved prior to the next processing cycle.

Enterprise Architecture and Solutions Environment (EASE) – Outsourced to U.S. Department of Agriculture, National Information Technology Center (USDA/NITC) facility, located in Kansas City, MO. USDA performs the daily IT Operations support role, with FAA Enterprise Services Center (ESC) providing a limited support role for IBM z/OS mainframe and networking support must include, but is not limited to the following:

a. Basic Knowledge of z/Enterprise (z/OS, z/VM, and z/Linux) mainframe environments.

b. Assist NITC staff with z/OS software planning, testing, and verification, including patches and version upgrades, daily or per upgrade or project basis.

c. Working knowledge of z/system software, such as Time-Sharing Option (TSO), ISPF Editor, SDSF, JCL, mainframe utilities and batch programs.

d. Daily support of commercial off-the-shelf (COTS) software, utilities, compilers, and programming languages, for z/systems.

e. Monitor and report z/OS transaction metrics to business office in support of Service Level Agreements (SLA), and pricing, on a monthly basis.

f. Activities addressed in the facility management plan:

• Job control language support

• Backups

• z/OS security upgrades and patches

• z/OS Secure File Transfer (SFTP) support for interfaces

g. z/OS Citrix support for customer access, timeframes as documented in the NACO Technical Operations Plan.

h. Assist with new customer requirements for z/OS Mainframe systems, on a project/upgrade basis.

i. Investigate and resolve access issues on an ad-hoc basis as they occur.

j. Practical working knowledge of Vanguard Security toolsets.

k. Practical knowledge of ITSM for change/incident management requirements, and account provisioning software.

l. In depth knowledge of Resource Access Control Facility (RACF), and basic account access control industry and Federal government standards to perform z/OS based access management.

m. Basic knowledge of NIST, FISMA, and other federal regulations.

n. Analytical skills and knowledge for troubleshooting user and application access issues, and to provide resolution.

o. Review and update process documentation at a minimum annually or when changes are identified:

• EASE Facility Management Plan

• National Access Control Officer (NACO) Technical

Operating Procedure

• Computer Access Request System (CARS) Guides

• Mainframe Security Guide

• ISO 20K Security Process Owner

National Access Control Officer must include, but is not limited to the following.

a. Monitor NACO email mailbox daily, and take action on requests

b. Perform account administration tasks daily.

c. Perform software monthly production monitoring

d. Maintain software security tables.

e. Review and process daily delete transactions.

f. Establish and monitor elevated privilege accounts.

g. Perform as Access Control Officer and Technical Control Officer.

h. FAA’s NITC (USDA National Information Technology Center) Agency Role Membership Manager (ARMM) support must include, but is not limited to creating FAA roles and re-certifying user access using NITC Identity Manager, daily, weekly, and monthly with 24 x 7 on-call support.

Middle Tier Administration / Middle Tier Administrators (MTAs) Support must include, but is not limited to the following:

a. Monitor ticket queue(s) in applicable ticketing system(s) and work or route tickets within 10 minutes of arrival for all supported MTA systems and applications. Tickets must be transferred appropriately to federal or contract staff in accordance with the defined delineation of tasks.

b. Creating and following documented configuration and change management policies (including cookbooks and deployment plans for promotion to other environments).

c. Document and perform middle tier clone processes. One after year-end close and one after year-end-two close are mandatory but more are requested as needed. Overlays are required on an as needed basis.

d. Mitigating security vulnerabilities and adhering to security controls.

e. Implementing and maintaining Secure Sockets Layer (SSL) where deemed necessary and appropriate.

f. Creating and updating various custom web pages/sites while maintaining Section 508 compliance where deemed necessary and appropriate.

g. Administration and maintenance which includes, but is not limited to installing, configuring, patching, cloning, troubleshooting, hardening, securing, testing, and monitoring applications.

h. Ensuring the application or middleware is configured and functioning properly will include communication, coordination and testing with the networking team, firewall team, client/desktop support, database team, development team, system administration team, functional staff, customer (and/or end-user), and interfaces between other systems (e.g.

SOA, IDM, etc.) inside and outside of the Enterprise Services Center.

i. Contractor must provide personnel with working knowledge of technologies which support the currently supported middleware software and web applications.

Database Management (Development/Test/Production).

Support for financial and non-financial database systems. Support must include, but is not limited to the following:

a. Quarterly, emergency, and security mandated patching as required.

b. Monitor incoming established ticketing system(s) queue and work or route tickets as they arrive within 10 minutes, according to established work instructions.

c. Disk overlays and clones.

d. Disk Space management.

e. DB User management.

f. Instance created/management.

g. Monitoring to ensure system availability meets the customer's system level agreement (SLA)

h. Work with the System Administrators to test and resolve issues between the operating system and databases.

i. Coordinate system testing with the application developers and end users.

j. Write and update work instructions and ITIL best practices when documenting in preparations for system releases and installations.

k. Install/Manage oracle binaries.

l. Manage dblinks

m. Manage physical and logical standby database servers.

n. Provide security baseline checklists (SBCC) to security staff as requested.

o. Performance management (tuning analysis, performance issue analysis)

p. Manage automated storage instances (ASM)

q. Manage/troubleshoot Oracle Real Application Cluster (RAC) databases

r. Manage backup and recovery operations as required or requested.

s. Participate in disaster recovery exercises as required.

t. Manage Microsoft SQL Server clusters.

u. Manage MS SQL Servers installations and troubleshooting.

v. Provide database administration.

Server Administration (SA).

Support must include, but is not limited to the following.

a. Monitor incoming ticket queue and work or route tickets as they arrive within 10 minutes, according to established work instructions.

b. Monitor and report malicious and suspect activity on all systems.

c. Monitor and report any sensitive information stored improperly on systems. Investigate, diagnose and take prescribed actions on all operational events, alarms and incidents. Support ITIL Incident and Problem management process activities with system expertise and troubleshooting. (Critical)

d. Perform Server Storage Administration duties, which must include, but is not limited to storage requests, managing local file shares and mount points, and managing network shares including permissions. (High)

e. Local Account Administration which must include, but is not limited to create, delete, modify local accounts, password resets, and account group management. Perform local file management which must include, but is not limited to adding, removing, modifying file permissions and creating local file/folder shares. Perform Server Network Administration, which must include, but is not limited to IP Address Management (add, remove, modify), firewall rule requests, and DNS requests. Work all service request tickets from Service Desk according to desk aid and technical operating procedures. Monitor systems for up/down status and normal operation, report status to FAA.

Report on performance against service targets contained in service level agreements. (Normal)

f. Implement all operational procedures as documented in the technical operations procedures. Maintain operational logs and journals on all events, warnings, alerts and alarms; recording, classifying and reporting all messages for FAA personnel review. Perform SQL Server Administration (Windows), which must include, but is not limited to installing SQL Server, managing and maintaining SQL Storage at server level, and monitoring SQL Cluster logs. (Low)

g. Provide server/system administration.

Technical Clerical Support.

Support to all units of the Systems Technical Support Section (Systems Administration, Database & Web Management, Application Automation & Interface Support, and Infrastructure). Support must include, but is not limited to the following:

a. The primary workload involves ensuring existing documents are up-to-date, creating new process documents, attending meetings and publishing notes, and using Microsoft Office, especially Microsoft Visio, in the creation of technical charts and diagrams. All requests for these tasks will be sent via the workflow ticketing system.

b. There are approximately 250 processes and Technical Operating Procedures (TOPs) maintained in this area. ITIL, ISO 20000 and ISO 9001 frameworks are heavily utilized. Tasks will vary in size and complexity. On average there are about 5 meetings per week.

Occasionally, there are multiple meetings on the same day.

c. The information technology employee clearance desk must be operated from 0800-1630 each normal work day. The individual at this desk is responsible for entering a trouble ticket to ensure exiting employees no longer have access to FAA computer systems then signing a form signifying that the access has been removed and the employee is cleared to resign, retire, or transfer to another facility.

Definitions/Acronyms

Acronym, application or product

Definition or Description

ARMM FAA/NITC Agency Role Membership Manager

BMC

An Action Request System (ARS) is a proprietary application server. It is best known as being part of the BMC IT Management Suite, a set of applications that runs over ARS.

CARS

The Computer Access Request System (CARS) is considered system software and is an integral component for EASE, providing automated processing of account requests for all EASE customer applications that reside on the EASE platform. CARS is not available to the public, and is used for account access for only those systems that reside on the EASE platform.

CICS

Middleware designed to support rapid, high-volume online transaction processing. A CICS transaction is a unit of processing initiated by a single request that may affect one or more objects in IBM z/OS.

CPAR Contractor Performance Assessment Report

CSD Custom Solutions Division

Cookbook Deployment instructions

Dblink A database link is a connection between two physical database servers that allows a client to access them as one logical database.

DBMS Database Management System

Delphi Includes standard functionality provided by Oracle Federal Financials (Oracle eBusiness Suite) and enhancements or features developed and available through ESC

Dev/Test Application or database development and testing DTF Delphi Transaction File

EASE Enterprise Architecture and Solutions Environment mainframe environment running IBM z/OS.

EDW/BI Enterprise Data Warehouse/Business Intelligence

ESCPRISM

Includes standard functionality provided by CompuSearch PRISM Commercial Off The Shelf software, including enhancements or features developed and available through ESC.

FIIS Financial Intranet Information Systems FPPS Federal Personnel Payroll System

GRC Governance, Risk, and Compliance (GRC), a component of the Oracle Fusion Applications suite

GTAS

The Government-wide Treasury Account Symbol Adjusted Trial Balance System (GTAS) is the primary means of reporting agency trial balance data. A single data collection system improves the quality of financial data by combining budgetary and proprietary trial balance reporting, enforcing the USSGL, and implementing new edits and validations.

iSupplier Oracle iSupplier Portal is the enterprise application that structures all supplier communication through a secure internet-based portal.

MarkView Kofax MarkView® for AP automates the AP operations using Oracle E- Business Suite (EBS) to significantly reduce cycle times and costs while optimizing process control and cash flow management.

MVS Motor Vehicle System NACO National Access Control Officer NITC National Information Technology Center, located in Kansas City, Missouri NRC Nuclear Regulatory Commission O&M Operations and Maintenance OBIEE Oracle Business Intelligence Enterprise Edition OEDQ Oracle Enterprise Daily Quality OFCS Overflight Fee Collection System OHS Oracle HTTP Server OS Operation System RHEL Red Hat Enterprise Linux

Serena Process-based application for managing and automating application development, DevOps and release management.

SOA Service Oriented Architecture UAR User Access Request USDA United States Department of Agriculture USSGL The US Standard General Ledger z/OS A 64-bit operating system for IBM mainframes, produced by IBM. It derives from and is the successor to OS/390.

Performance Outcome(s)/Deliverable(s) The contractor must send a separate itemization or line item on the monthly invoice for each of the categories of work listed below as 5.1 through 5.5. The contractor must be penalized for failing task goals that are reworked by federal employees as appropriate for each category. The tables are drawn from service level agreements in existence for Department of Transportation and other federal agency customers.

Applications Administrator Complete all tasks according to the following table, standard work week (Monday through Friday, 0600-1800). For each unmet goal, the government will deduct up to 10% from the category line item of that month’s invoice.

Tickets must be routed appropriately to federal or contract staff in accordance with the defined delineation of tasks.

Critical Ticket task completed within 3 business hours, on 85% of the tickets in each calendar month

High Ticket task completed within 8 business hours, 90% of the calendar month

Medium Ticket task completed within 3 business days, 95% of the calendar month

Low Ticket task completed within 5 business days, 99% of the calendar month

Contractor must designate to the COR no less than two on-call 24 hours, 7 days per week, including holidays, personnel each week who must answer or return an emergency phone call within 15 minutes then begin resolving the problem within two hours. (Support during non-core hours, weekends, and holidays allow an additional 2 hours for all tickets.) If the issue is not within the scope of the contract duties, the on-call contractor must notify the help desk who will, in turn, notify FAA management according to FAA protocols. If neither of the two contract employees answers or returns the call within the allotted time, the help desk must notify FAA management. Failure to respond to the ticket or phone call and begin work within two hours of a criticalticket will result in a negative Contractor Performance Assessment Report (CPAR).

Scheduled migrations, month-end, year-end and releases occur between 45 and 52 weekends per year. This is not a criticalticket but weekend work is pre-scheduled and mandatory 100% of scheduled times. Failure to provide application administrators capable of completing all tasks listed in Section 3.1 for each scheduled weekend or after-hours work will result in a negative CPAR and a deduction of up to 20% of the monthly category invoice for each failure.

Tiers of service required for Application Administrators:

• Tier 1 -Zero

• Tier 2 - Up to 15,000 tickets per year

• Tier 3 - 15,001 to 20,000 tickets per year

• Tier 4 - 20,001 to 25,000 tickets per year

• Tier 5 – 25,001 to 35,000 tickets per year

• Tier 6 - 35,0001 to 40,000 tickets per year

• Small customer add-on=1,458 more tickets

• Large customer add-on=2,917 more tickets

Note: Tiers will be performed by Contractor

Middle Tier Monitor ticket queue(s) in applicable ticketing system(s) and work or route tickets within 10 minutes of arrival for all supported MTA systems and applications. For unmet goals, the government will deduct up to 10% from the category line item of that month’s invoice. Tickets must be routed appropriately to federal or contract staff in accordance with the defined delineation of tasks.

Established timelines are as follows:

Critical Ticket task completed within 3 business hours, on 85% of the tickets in each calendar month

High Ticket task completed within 8 business hours, 90% of the calendar month.

Medium Ticket task completed within 3 business days, 95% of the calendar month.

Low Ticket task completed within 5 business days, 99% of the calendar month.

Contractor must designate no less than two on-call 24/7/365 personnel each week that must answer an emergency phone call within 15 minutes then begin resolving the problem within two hours. If the issue is not within the scope of the contract duties, the on-call contractor must notify the help desk who will, in turn, notify FAA management. If neither of the two contract employees answers the on-call phone within the allotted time, the help desk must notify FAA management. Failure to respond to the phone call or begin work within two hours will result in a negative CPAR.

Tiers of service required:

• Tier 1 - Zero tickets per year.

• Tier 2 - Up to 1,500 tickets per year

• Tier 3 - 1,501 to 2,154 tickets per year

• Tier 4 - 2,155 to 2,350 tickets per year

• Tier 5 - 2,351 to 2,694 tickets per year

• Tier 6 - 2,695 to 3,234 tickets per year

• Add-on (small): 500 additional tickets per year

• Add-on (large): 1,000 additional tickets per year

Note: Tiers will be performed by Contractor

Database Administrators Monitor ticket queue(s) in applicable ticketing system(s) and work or route tickets within 10 minutes of arrival for all supported systems and applications.

Tickets must be routed appropriately to federal or contract staff in accordance with the defined delineation of tasks. For unmet goals, up to 10% will be deducted from that month’s invoice. Established timelines are as follows:

Critical Ticket task completed within 90 minutes, 1.5 business hours, on 85% of the tickets in each calendar month

High Ticket task completed within 8 business hours, 90% of the calendar month

Medium Ticket task completed within 3 business days, 95% of the calendar month

Low Ticket task completed within 5 business days, 99% of the calendar month

Contractor must designate to the COR no less than two on-call 24/7/365 personnel each week that must answer an emergency phone call within 15 minutes then begin resolving the problem within two hours. If the issue is not within the scope of the contract duties, the on-call contractor must notify the help desk who will, in turn, notify FAA management. If neither of the two contract employees answers the on-call phone within the allotted time, the help desk must notify FAA management. Failure to respond to the phone call or begin work within two hours will result in a negative CPAR.

Tiers of service required:

• Tier 1 - Zero tickets per year

• Tier 2 - Up…